LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

CVE-2020-27223

CVE-2020-27223 Uso $ mvn spring-boot:run 9.4.36.v20210114 $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s 9.4.37.v20210219 Corregido $...

CLEANSTART-2024-IK84393 attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse

CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details...

GO-2026-6539 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition

nginx ignition has ParseAcceptLanguage separator bypass that enables 75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition...

Linux Distros Unpatched Vulnerability : CVE-2026-61629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in...

UBUNTU-CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

EUVD-2026-83924

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61629

nginx-ignition (a user interface for the nginx web server) versions 2.29.0 through 2.40.0 are vulnerable to a CPU amplification denial-of-service via the Accept-Language HTTP header. The gin i18n middleware calls golang.org/x/text/language.ParseAcceptLanguage on the raw header without size or sha...

CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61629: Allocation of Resources Without Limits or Throttling

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

PT-2026-96109

Name of the Vulnerable Software and Affected Versions nginx ignition versions 2.29.0 through 2.40.0 Description The API server in nginx ignition contains a flaw in its i18nMiddleware function that processes the Accept-Language header. The middleware calls...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of the Accept-Language header are cached in order to avoid repeated parsing. This can lead to a potential denial-of-service vulnerability due to excessive memory usage if the raw value of the Accept-Language...

Astra Linux – Vulnerability in golang-golang-x-text

An attacker can cause a denial of service by creating an Accept-Language header that requires ParseAcceptLanguage to take significant time to process...

Astra Linux – Vulnerability in golang-golang-x-text

In Go 1.15.4, a "index out of range" panic occurs in the language.ParseAcceptLanguage function during the parsing of the -u- extension. The language.ParseAcceptLanguage function is supposed to be able to parse an HTTP Accept-Language header...

CVE-2026-73635

A flaw was found in Apache Struts. An unauthenticated remote client can exploit a vulnerability where the framework's localized-text caches grow without bound. This occurs when no fixed locale is configured, and the locale for text lookups is derived from the incoming request. This can lead to th...

CVE-2026-49329

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...